lkml.org 
[lkml]   [2012]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[10/49] wl12xx: Check buffer bound when processing nvs data
    3.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Pontus Fuchs <pontus.fuchs@gmail.com>

    commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.

    An nvs with malformed contents could cause the processing of the
    calibration data to read beyond the end of the buffer. Prevent this
    from happening by adding bound checking.

    Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
    Reviewed-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++
    1 file changed, 14 insertions(+)

    --- a/drivers/net/wireless/wl12xx/boot.c
    +++ b/drivers/net/wireless/wl12xx/boot.c
    @@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct
    nvs_ptr += 3;

    for (i = 0; i < burst_len; i++) {
    + if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
    + goto out_badnvs;
    +
    val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
    | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));

    @@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct
    nvs_ptr += 4;
    dest_addr += 4;
    }
    +
    + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
    + goto out_badnvs;
    }

    /*
    @@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct
    */
    nvs_ptr = (u8 *)wl->nvs +
    ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
    +
    + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
    + goto out_badnvs;
    +
    nvs_len -= nvs_ptr - (u8 *)wl->nvs;

    /* Now we must set the partition correctly */
    @@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct

    kfree(nvs_aligned);
    return 0;
    +
    +out_badnvs:
    + wl1271_error("nvs data is malformed");
    + return -EILSEQ;
    }

    static void wl1271_boot_enable_interrupts(struct wl1271 *wl)



    \
     
     \ /
      Last update: 2012-01-11 00:11    [W:2.995 / U:0.296 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site